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1 INTRODUCTION 

1.1 The Personal Data Protection Act 2012 (No. 26 of 2012) ("PDPA") governs the 
collection, use and disclosure of individuals' personal data by organisations^ in a 
manner that recognises both the right of individuals to protect their personal data 
and the need for organisations to collect, use and disclose personal data for purposes 
that a reasonable person would consider appropriate in the circumstances. The PDPA 
comprises two main sets of provisions, covering the Data Protection Provisions and 
Do Not Call Provisions. 

1.2 These guidelines provide an overview of the obligations under the PDPA and how 
they may apply to election activities^ that involve the collection, use or disclosure of 
personal data. These Guidelines are intended to highlight specific aspects of the 
PDPA, and are not intended to exhaustively address every obligation in the PDPA or 
every scenario or arrangement that may arise in the context of the election activities. 
These Guidelines should be read in conjunction with the document titled 
"Introduction to the Guidelines", including the disclaimers set out therein. 

1.3 You are encouraged to also read the Advisory Guidelines on Key Concepts in the 
PDPA, as well as any other relevant Guidelines that the Personal Data Protection 
Commission ("PDPC") may issue from time to time. 

2 APPLICATION OF PDPA TO ELECTION ACTIVITIES 

2.1 Personal data is defined in the PDPA as "data, whether true or not, about an 
individual who can be identified — 

(a) from that data; or 

(b) from that data and other information to which the organisation has or is likely to 
have access." 

2.2 Examples of personal data include an individual's full name, NRIC number, passport 
number, photograph or video image of the individual, personal mobile telephone 
number, and may include personal email address and residential address. 

2.3 The PDPA applies to all organisations that undertake any activities relating to the 
collection, use or disclosure of personal data in Singapore, unless they fall within a 
category of organisations that is expressly excluded from the application of the PDPA. 
The following categories of organisations are excluded from the application of the 
Data Protection Provisions: 


^The PDPA defines an organisation as "any individual, company, association or body of persons, corporate or 
unincorporated whether or not formed or recognised under the law of Singapore; or resident, or having an office 
or a place of business, in Singapore". 

^ Please refer to the latest Candidate Handbook issued by Elections Department Singapore for more information. 
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(a) Any individual acting in a personal or domestic capacity; 

(b) Any employee ^ acting in the course of his or her employment with an 
organisation; 

(c) Any public agency; and 

(d) Any organisation in the course of acting on behalf of a public agency in relation 
to the collection, use or disclosure of personal data. 

Application of the PDPA to political parties and election candidates 

2.4 Under the PDPA, political parties and election candidates that conduct election 
activities involving the collection, use or disclosure of personal data are not per se 
excluded from the Data Protection Provisions. In particular, election candidates will 
not be treated as carrying out election activities in a personal or domestic capacity. 

2.5 Further, political parties and election candidates are reminded that they can be held 
responsible for the actions of their employees (including volunteers) and data 
intermediaries. 

2.6 As a general matter, an organisation is responsible for any act done by its employee 
in the course of his employment with the organisation"^. Under the PDPA, an 
"employee" includes a volunteer, and "employment" includes working under an 
unpaid volunteer work relationship. Therefore, employees could include individuals 
who are enlisted by the political party or election candidate to perform tasks and 
undertake responsibilities in contribution to the party or the election candidate 
under an unpaid volunteer work relationship. For example, this may include 
volunteers enlisted by the political party to canvass votes on behalf of the party, and 
individuals enlisted by election candidates to be election agents. 

2.7 Political parties and election candidates should therefore put in place policies and 
procedures, and conduct the necessary training to ensure the appropriate handling 
of personal data by persons whom they engage to perform tasks on their behalf. As 
good practice, political parties and election candidates should ensure that such 
persons, including volunteers who are involved in election activities, are properly 
briefed and appropriately supervised to ensure compliance with the PDPA. 


^ Any individual who undertakes work without an expectation of payment is also considered an "employee". 

Section 53(1) of the PDPA provides that, "Any act done or conduct engaged in by a person in the course of his 
employment (referred to in this section as the employee) shall be treated for the purposes of this Act as done 
or engaged in by his employer as well as by him, whether or not it was done or engaged in with the employer's 
knowledge or approval." 
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Election candidates who are affiliated with a political party 

2.8 Election candidates who are affiliated with a political party may similarly be 
considered employees of the political party for purposes of the PDPA^. In particular, 
if an election candidate acted within the scope of his role assigned by the political 
party to further the aims of the political party, then the candidate will likely be 
treated as an employee under the PDPA. As such, political parties should ensure that 
their candidates are briefed on the parties' data protection policies to prevent 
inadvertent breaches of the PDPA. 

2.9 Depending on the facts of the case, the Data Protection Provisions can still apply to 
an election candidate even if he or she is affiliated with a political party, and the 
culpability for breach of the Data Protection Provisions can rest with the candidate. 
For instance, when the election candidate deliberately accesses and uses the 
personal data for his own aims in contravention of the political party's policies, the 
candidate could be treated as a separate organisation from the political party for the 
purposes of compliance with the PDPA, despite his affiliation with the political party®. 

2.10 In determining whether or not the political party is responsible for the actions of the 
election candidate, the PDPC may consider^, for instance, the extent to which the 
election candidate acted outside the scope of his or her role assigned by the political 
party, the extent to which the actions furthered the political party's aims or the 
candidate's own aims, and the opportunity afforded to the candidate to commit the 
breach. 

Application of the PDPA to data intermediaries 

2.11 A data intermediary is defined under the PDPA as an organisation that processes 
personal data on behalf of another organisation, but does not include an employee 
of that other organisation. Under the PDPA, a data intermediary that processes 
personal data pursuant to a contract, which is evidenced or made in writing, will be 
subject to the Protection and Retention Limitation Obligations, and not any of the 
other Data Protection Provisions. The organisation that engages the data 
intermediary will have the same obligations under the PDPA in respect of personal 
data processed on its behalf, as if the personal data were processed by the 
organisation itself. 


^ As the PDPA defines "employee" to include a volunteer, to the extent that an election candidate of a political 
party performs tasks and undertakes responsibilities in contribution to the party on an unpaid basis, or works 
for the party under an unpaid volunteer work relationship, he/she would fall within the definition of "employee" 
under the PDPA. 

® To be clear, even where an election candidate is found to have acted as a separate organisation in the scenario, 
the political party may also be held liable for contravention of the PDPA depending on the facts of the case, for 
example, if the political party did not put in place reasonable security arrangements to protect the personal data 
in its possession or under its control. 

This will be a highly factual inquiry and the considerations set out here are neither conclusive nor exhaustive. 
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2.12 


Example: Political party hires vendor to manage social media campaign and 
social media profile platform 


Political party ABC engages public relations firm, DEF, to run the party's social 
media campaign, as well as manage its social media profile platform. Among other 
things, the written contract between political party ABC and DEF specifies that DEF 
will use an ABC-provided list containing personal data of constituents to send 
updates on the party's election-related activities to those who have signed up to 
receive the information. 


In this case, DEF will be considered a data intermediary of political party ABC, and 
DEF will be subject only to the Protection and Retention Limitation Obligations. 
Political party ABC will have the same obligations under the PDPA in respect of the 
constituents' personal data processed on its behalf by DEF, as if the personal data 
were processed by political party ABC itself. 


2.13 To be clear, when a data intermediary carries out activities that go beyond the 
processing required by the political party and election candidate under the contract, 
the data intermediary will be required to comply with all Data Protection Provisions. 

3 RIGHTS AND OBLIGATIONS ETC UNDER OTHER LAWS 

3.1 Section 4(6) of the PDPA states that unless otherwise provided in the PDPA, nothing 
in Parts III to VI of the PDPA shall affect any authority, right, privilege or immunity 
conferred, or obligation or limitation imposed, by or under the law, including legal 
privilege, except that the performance of a contractual obligation shall not be an 
excuse for contravening the PDPA, and the provisions of other written law shall 
prevail to the extent that any provision of Parts III to VI is inconsistent with the 
provisions of that other written law. Other provisions in the PDPA which are not 
inconsistent with other written law will continue to apply. 

3.2 Political parties and election candidates should ensure that they comply with 
relevant laws and regulatory requirements governing election activities ("relevant 
laws")®. For example, under the Parliamentary Elections Act (Cap. 218), political 
parties and election candidates may purchase a copy of the registers of electors and 
use the information in the registers only for communicating with electors. Political 
parties and election candidates may therefore collect, use or disclose such 
information, without obtaining consent under the PDPA, to the extent that such 
collection, use or disclosure is for the purpose of communicating with electors in 
accordance with the Parliamentary Elections Act. 


® For more information on the relevant laws and regulatory requirements governing election activities, please 
refer to the Parliamentary Elections Act and the Presidential Elections Act, and their subsidiary legislation. 
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3.3 For the avoidance of doubt, whilst political parties and election candidates may 
collect, use or disclose personal data without consent where permitted under other 
relevant legislation, other Data Protection Provisions under the PDPA will still apply 
to the extent that they are not inconsistent with other legislation. 

4 DATA PROTECTION PROVISIONS 

4.1 The Data Protection Provisions contain nine key obligations which political parties 
and election candidates are required to comply with if they undertake election 
activities relating to the collection, use or disclosure of personal data. The following 
section outlines how the Data Protection Provisions may apply to political parties' 
and election candidates' data activities: 

Consent Obligation 

4.2 A political party or election candidate must obtain the consent of the individual 
before collecting, using or disclosing his or her personal data for a purpose, unless 
the collection, use or disclosure without consent is required or authorised under the 
PDPA or other written law. This would include the personal data of employees 
(including election agents and volunteers) and potential voters. 

4.3 A political party or election candidate that takes a photograph of an identifiable 
individual will be required to obtain consent, unless an exception applies. In 
particular, there is an exception for the collection, use and disclosure of personal 
data that is publicly available®. For example, when the individual appears at an event 
or location that is open to the public, taking a photograph of the individual would 
likely constitute collection of personal data that is publicly available for which 
consent is not required. Nevertheless, as a matter of good practice, political parties 
and election candidates should still provide signage or other forms of obvious notice 
to notify the public that photography is taking place. 

4.4 A political party or election candidate may only collect, use or disclose personal data 
from a third party source, if the third party source can validly give consent on behalf 
of the individual for the collection, use or disclosure of his or her personal data; or 
the individual has provided consent to the disclosure of his or her personal data by 
the third party to the political party or election candidate for their intended purposes, 
unless an exception^°applies. As good practice, where a political party or election 
candidate has obtained the individual's personal data from a third party source, that 


® Please refer to the Advisory Guidelines on Key Concepts in the PDPA at www.pdpc.gov.sg for more guidance 
as to what is publicly available data. 

Please refer to the Second Schedule (collection of personal data without consent), Third Schedule (use of 
personal data without consent) and Fourth Schedule (disclosure of personal data without consent) of the PDPA 
for more information. 
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political party or election candidate should inform the individual, upon request, of 
how his or her personal data was obtained by the political party or election candidate. 

4.5 The political party or election candidate must allow an individual to withdraw his or 
her consent^^for the collection, use or disclosure of his or her personal data for a 
purpose^^. As good practice, political parties or election candidate should keep a list 
of individuals who have exercised their right to withdraw their consent for the 
collection, use or disclosure of his or her personal data. 

4.6 Political parties and election candidates are reminded that the collection, use or 
disclosure of such personal data must be in accordance with the relevant laws 
governing election activities, and political parties and election candidates also must 
not obtain, or attempt to obtain, consent by providing false or misleading 
information or using deceptive or misleading practices. 

4.7 A political party or election candidate may continue to use the personal data of 
individuals that was collected before 2 July 2014 for the purposes for which it was 
collected, unless consent is withdrawn under the PDPA or the individual had 
otherwise indicated that he or she does not consent to such use. Fresh consent is 
required for the use of such personal data for new purposes. 

4.8 A political party or election candidate is not required to obtain consent before 
collecting, using or disclosing any business contact information, or to comply with 
any other obligation in the Data Protection Provisions in relation to business contact 
information. Under the PDPA, business contact information refers to an individual's 
name, position name ortitle, business telephone number, business address, business 
electronic mail address, or business fax number and any other similar information 
about the individual, not provided by the individual solely for his or her personal 
purposes^^. 

Purpose Limitation Obligation 

4.9 A political party or election candidate may collect, use or disclose personal data 
about an individual only for purposes that a reasonable person would consider 
appropriate in the circumstances and, if applicable, have been notified to the 
individual concerned. 

4.10 A political party or election candidate should specify purposes, which should be 
reasonable, at an appropriate level of detail that will allow the individual to 
determine the reasons the political party or election candidate is collecting, using or 
disclosing his or her personal data. To be clear, there is no need forthe political party 


Section 16 of the PDPA sets out a number of requirements that must be complied with by either the individual 
or the organisation in relation to a withdrawal of consent by the individual. 

Please refer to PDPC's Advisory Guidelines on Key Concepts in the PDPA at www.pdpc.gov.sg for more details 
on the actions that organisations are required to take upon receiving a notice of withdrawal of consent. 

Please refer to PDPC's Advisory Guidelines on Key Concepts in the PDPA at www.pdpc.gov.sg for more 
guidance on what amounts to business contact information. 
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or election candidate to specify every activity that is undertaken in relation to 
collecting, using or disclosing personal data when notifying individuals of its purposes, 
provided that an appropriate level of detail is provided. 

4.11 The Purpose Limitation Obligation similarly applies in situations where political 
parties or election candidates collect personal data from third party sources. 

Notification Obligation 

4.12 A political party or election candidate must notify^^the individual of the purposes for 
which it intends to collect, use or disclose his or her personal data on or before such 
collection, use or disclosure of the personal data. 


4.13 

Example: Taking photographs of individuals at election activities in a private 
space 

Candidate A who does not belong to a political party wishes to take photographs 
of individuals at his election activities for use in his election campaign, including 
posting the photographs on his election campaign website and social media 
platforms. 

During Candidate A's house-to-house visit to Mr. Tan's residence. Candidate A's 
photographer informs Mr. Tan of the purpose for the photo-taking (i.e. to be used 
in Candidate A's election campaign, including posting on his election campaign 
website and social medium platforms), and obtains Mr. Tan's consent to take 
photographs of him in his house. 

In this case. Candidate A may post the photographs taken of Mr. Tan during the 
house-to-house visit on his election campaign website and Facebook page. 

Should Mr. Tan withdraw consent for the use or disclosure of his photograph. 
Candidate A must stop using or disclosing the photograph concerned, as well as 
inform his data intermediaries and agents to cease using or disclosing the 
photograph for this purpose. Candidate A can cease further use or disclosure of 
the photograph in question by removing the photograph, or masking the image 
of Mr. Tan on his election campaign website or Facebook page. 

4.14 

Example: Taking photographs of individuals at election activities in public 
spaces 

Candidate B is part of Political Party B. Political Party B would like to have 
photographs of Candidate B meeting individuals taken during his walkabouts at 
public places such as wet markets, hawker centres, public housing void decks and 
corridors, for the purpose of publishing the photographs on Political Party B's and 
Candidate B's social media platforms. 


Please refer to PDPC's Guide to Notification at www.pdpc.gov.sg for more information. 
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There is no need to obtain consent to take photographs of individuals appearing 
at such locations, as an exception under the PDPA provides for personal data that 
is publicly available to be collected, used or disclosed without the individual's 
consent. Nonetheless, as good practice, photographs should be taken openly and 
not clandestinely, and individuals should be notified of the purpose of the 
photography where possible. 

4.15 

Example: Collecting and using personal data for election-related 
communications 

Political Party C wishes to collect the names and contact details of individuals who 
attend its outreach events so it can send them information about the Party's 
upcoming events and election-related communications. 

Political Party C uses a form to collect the name and email address of each 
individual attending its events. The form states clearly the personal data collected 
is for the purpose of sending information about the Party's upcoming events and 
election-related communications, and also provides information about how the 
individual may withdraw consent for this purpose. 

In this case. Political Party C may use the personal data collected to send 
information about its upcoming events and election-related communications to 
email addresses of the individuals who provided their personal data for this 
purpose. 

Political Party C must also facilitate any requests from individuals to withdraw 
their consent for this purpose. Upon withdrawal of consent. Political Party C must 
cease to collect, use or disclose the personal data, and inform its data 
intermediaries and agents to cease to collect, use or disclose the personal data 
forthis purpose (unlessthis is required orauthorised underthe PDPAorany other 
written law). 


Access and Correction Obligations 

4.16 A political party or election candidate must, upon request, (a) provide an individual 
with his or her personal data in the possession or under the control of the 
organisation and information about the ways in which the personal data may have 
been used or disclosed during the past year^^; or (b) correct an error or omission in 
an individual's personal data that is in the possession or under the control of the 
organisation. 


Please refer to PDPC's Guide to Handling Access Requests at www.pdpc.gov.sg for more information. 
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Accuracy Obligation 

4.17 A political party or election candidate must make a reasonable effort to ensure that 
personal data collected by or on behalf of the political party or election candidate is 
accurate and complete if the personal data is likely to be used by the political party 
or election candidate to make a decision that affects the indiyidual concerned, or is 
likely to be disclosed by the political party or election candidate to another 
organisation. 

Protection Obligation 

4.18 A political party or election candidate must protect all personal data in its possession 
or under its control by making reasonable security arrangements to preyent 
accidental or unauthorised access, collection, use, disclosure, copying, modification, 
disposal or similar risks (e.g. cyber-attacks, hacking)^®. This includes, but is not limited 
to, protecting the personal data of indiyiduals from whom they haye receiyed 
political donations, persons on the registers of electors, and potential yoters. 

4.19 Political parties and election candidates should also deyelop and put in place clear 
policies to ensure that the personal data of their employees (including election 
agents and yolunteers) is protected. 


4.20 


Example: Protecting personal data of electors 


Candidate D is affiliated with Political Party D. Candidate D wishes to use personal 
data which Political Party D obtained from the registers of electors to distribute 
personalised election mailers to electors in each household. The full names and 
residential addresses of electors in each household are printed on the personalised 
election mailers and placed on the doors or gates of the electors' houses. 


Under the PDPA, Political Party D and Candidate D must ensure the proper 
handling and security of personal data to preyent unauthorised access, use or 
disclosure, or similar risks. As good practice, instead of leaying the personalised 
election mailers bearing the electors' full names and residential addresses on the 
doors or gates of their houses. Candidate D may, for example, slot the personalised 
election mailers into the letterboxes of landed houses or under the doors of public 
housing flats if the recipients are not home. 


Retention Obligation 

4.21 A political party and election candidate must cease to retain documents containing 
personal data, or anonymise it, as soon as it is reasonable to assume that (a) the 
purpose for which the personal data was collected is no longer being seryed by 


Please refer to PDPC's Advisory Guidelines on Key Concepts in the PDPA and Guide to Securing Personal Data 
in Electronic Medium at www.pdpc.gov.sg for more information on protection of personal data. 
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retention of the personal data, and (b) retention is no longer necessary for legal or 
business purposes. 

4.22 The PDPA does not prescribe a specific retention period for personal data. When 
developing or reviewing its retention policy and period for personal data, a political 
party and election candidate should consider whether one or more of the purposes 
for which the personal data was collected is still being served by the retention of the 
personal data, and whether retention of the personal data is necessary for other 
legal or business purposes. Political parties and election candidates should be 
mindful not to unnecessarily preserve personal data "just in case" or in order to meet 
unforeseen circumstances. 

Openness Obligation 

4.23 The Data Protection Provisions contain a number of obligations in various sections 
which require organisations to develop and implement policies and practices that 
are necessary for the organisation to meet its obligations under the PDPA and to 
make information about their data protection policies and practices available, on 
request. 

4.24 As good practice, political parties and election candidates who collect, use or disclose 
personal data may consider making their data protection policies available via their 
websites. 

4.25 A political party and election candidate should also designate at least one individual 
responsible for ensuring its compliance with the PDPA (i.e. a data protection officer 
or "DPO"). The business contact information of that individual has to be made 
available and as good practice, should be readily accessible and operational during 
Singapore business hours and in the case of telephone numbers, be Singapore 
telephone numbers. The intent is to allow individuals to contact the DPO easily for 
any data protection related queries or concerns, so that the individual's queries or 
concerns may be addressed in a timely manner. 

5 DO NOT CALL PROVISIONS 

5.1 The Do Not Call Provisions under the PDPA generally apply to marketing messages 
sent to a Singapore telephone number. 

5.2 A message, the sole purpose of which is for election campaigning would not be 
covered by the Do Not Call Provisions, provided it does not offer to supply, offer, 
advertise or promote a good or service, or include any of the other purposes listed 
in the definition of a 'specified message' under the PDPA^^. In addition, the Eighth 
Schedule of the PDPA provides for messages that will not be considered 'specified 
messages' for the purpose of the Do Not Call Provisions. 


Section 37 of the PDPA defines what constitutes a 'specified message' for the purpose of the PDPA. 
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5.3 If a political party or election candidate intends to send a specified message to a 
Singapore telephone number, the political party or election candidate must comply 
with the Do Not Call Provisions. For more information, please refer to the Advisory 
Guidelines on the Do Not Call Provisions. 


END OF DOCUMENT 
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